- contact@verticalserve.com
SOC reports, contracts, insurance certificates and DPAs are confidential to your vendors and to you. InsightVendors keeps tenants apart in the database, keeps agents bounded and grounded, and runs in our cloud or yours.
We operate it. Shared monitoring collected once and matched to every tenant’s vendors; the vendor network will live here (planned).
The same images with Docker Compose, your PostgreSQL, your object storage, your identity provider. Network features off.
Point the agents at the model you approve — or run with none: every agent has a real rule-based path.
Every tenant table carries the organisation and is protected by PostgreSQL row-level security as a second line behind the application.
Sign-in over OIDC with your provider’s MFA; roles for admin, procurement, reviewer, requester and auditor.
Each assessment has its own signed link; the vendor sees only that assessment and what it uploaded.
Email approval links are signed, expire and work once; every decision is recorded with who and when.
A number in a model answer that is not in the source throws the answer away; daily budgets; kill switch; personal data masked in traces.
Every message an agent writes waits in the outbox until a person releases, edits or cancels it.
Requests, lane decisions, documents, findings, signals and every agent run with its input, output, level and citations.
Approved vendors, SOC reviews and CUEC mappings to InsightAssure; findings and decisions for your regulator.
An independent penetration test is planned before the first external production customer; we will share the summary under NDA.
Confirm the exact wording with your compliance team; this is how the product’s records line up with each regime.
| Regime | What it asks for | Where InsightVendors keeps it |
|---|---|---|
| DORA (EU, from 17 Jan 2025) | ICT third-party risk management, due diligence, contract terms, register of information, exit strategies | Tiers, documents, contract terms, monitoring; register export planned |
| US interagency guidance (2023) | A risk-based lifecycle: planning, due diligence, contract negotiation, ongoing monitoring, termination | The request-to-offboarding lifecycle, per vendor |
| NYDFS 23 NYCRR 500.11 | A third-party service provider security policy, due diligence and periodic assessment | Tier-based reassessment cadence, assessments, findings |
| EBA outsourcing guidelines | Outsourcing register, risk assessment before outsourcing, monitoring, exit | Vendor records, risk scores, signals, offboarding |
| GDPR Article 28 | Processor guarantees and contract terms; subprocessor control | DPA review, subprocessor extraction, privacy lane |
| SOC 2 CC9.2 · ISO 27001 A.5.19–5.23 | Vendor and supplier risk management, supplier agreements, monitoring | The whole record, exported to InsightAssure |